Scammers Impersonate IT Support on Microsoft Teams: How to Spot Fake Help Calls

Cybercriminals have started a new scam where they call people through Microsoft Teams voice calls, pretending to be IT support staff from the victim's own company. The scammers convince employees that there is a technical problem and talk them through steps to fix it. These steps actually install malware called EtherRAT on the work computer, giving attackers access to the entire corporate network.

This attack primarily targets people at their workplaces, not personal or home Microsoft accounts. If you or your spouse uses Microsoft Teams for work, you could receive one of these fake support calls. The scammers are convincing because they use Teams itself, which makes the call seem legitimate and internal to your company. Once the malware is installed, attackers can steal company data, passwords, and potentially access systems containing employee personal information.

If you use Microsoft Teams at work, take these steps immediately. First, never follow technical instructions from someone who calls you unexpectedly, even if they appear to be calling through Teams. Second, if someone claiming to be IT support contacts you, hang up and call your actual IT department using the phone number or contact method you already have. Third, tell your workplace about this threat so they can warn other employees. Fourth, never download or install software because someone on a call told you to do so.

Make it a rule to be suspicious of unexpected help. Real IT departments usually create support tickets and have verification processes. They rarely cold call employees and ask them to install things immediately. Apply this same caution at home: legitimate tech companies like Microsoft, Apple, or your internet provider will never call you out of the blue asking you to install software or provide remote access to your computer. When in doubt, hang up and contact the company yourself using an official phone number from their website.